problèmes de virus

Salut,

J'ai un problème de virus. J'ai fait un scan de hijackthis puis un scan de Navilog1.
Si une ame charitable pouvait m'aider. Merci d'avance.

scan haijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:50:05, on 05/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Lexmark 6300 Series\lxcdmon.exe
C:\Program Files\Lexmark 6300 Series\ezprint.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\lxcdcoms.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Documents and Settings\JUSTINE\Bureau\hijackthis\HiJackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F3 - REG:win.ini: run=
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb106\Dealio.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Vimicro USB PC Camera (ZC0301PL)
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [LXCDCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCDtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [lxcdmon.exe] "C:\Program Files\Lexmark 6300 Series\lxcdmon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 6300 Series\ezprint.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [NI.UGA6PV_0001_N108M0207] "c:\documents and settings\justine\application data\install_fr[1].exe" -nag
O4 - HKLM\..\Run: [f8d5f266] rundll32.exe "C:\WINDOWS\system32\pcmteyup.dll",b
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Program Files\Dealio\kb106\res\DealioSearch.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb106\Dealio.dll
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb106\Dealio.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.google.fr/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1145373048335
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharger.php?id=2&version=
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00E087D.dat
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxcd_device - Unknown owner - C:\WINDOWS\system32\lxcdcoms.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

--
End of file - 10159 bytes


Scan navilog1

Search Navipromo version 3.3.4 commencé le 05/11/2007 à 14:55:21,12

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Mise à jour le 02.11.2007 à 12h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.2180


*** Recherche Programmes installés ***




*** Recherche dossiers dans C:\WINDOWS ***



*** Recherche dossiers dans C:\Program Files ***



*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***




*** Recherche dossiers dans C:\Documents and Settings\JUSTINE\Application Data ***


*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1 ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

!! Fichier(s)/processus caché(s) différent(s) !!
!! Résultat Catchme non pris en compte par Navilog1 !!


*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans C:\WINDOWS\system32 *

* Recherche dans C:\DOCUME~1\JUSTINE\LOCALS~1\APPLIC~1 *



*** Recherche fichiers ***




*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:
C:\WINDOWS\system32\qpstv.ini2 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\qpstv.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\qpstv.bak2 trouvé ! infection Vundo possible non traitée par cet outil !

2)Recherche Heuristique :



3)Recherche Certificats :

Certificat Egroup absent !


*** Analyse terminée le 05/11/2007 à 14:56:59,05 ***

Bonjour infection Vundo

Télécharger sur le Bureau : VundoFix

= Double-clic VundoFix.exe.
= Clic OK
=Attendre le redemarrage de Vundofix
=Clic Scan for Vundo
= le scan est assez long , à la fin
=Clic Remove Vundo
= Puis yes
= Le Bureau disparaît un moment lors de la suppression des fichiers.
=Message shutdown
=clic OK
=Redémarrage auto
Note : il peut y avoir plusieurs redémarrages
= le rapport se trouve dans C:\vundofix.txt

tu postes le rapport vundofix

======================

Télécharger sur le bureau
VirtumondoBegone

=Double clic sur VirtumundoBeGone.exe
=clic Continue
=clic Start
=clic Oui
=A la fin si Vundo est présent , le PC s’éteint et redémarre

Si Ecran bleu et message : Erreur fatale .. pas de problème

=Poster le rapport VBG.TXT qui est sur le bureau

Télécharger et enregistrer sur le bureau
Combofix

=Double-clic sur Combofix
= Presser 1 quand demandé
= Attendre la fermeture de l’outil ( 5 à 10 mn)
=Copier/coller le rapport dans la réponse
Un rapport dans C:\Combofix.txt à mettre dans la réponse
ComboFix-quarantined-files + Qoobox sont eux à supprimer
=======================================================
merci de mettre tous les rapports sous Spoiler

pour cela sélectionner la totalité de chaque rapport mis dans la case réponse
et clic sur le point d'interrogation en bas à droite de cette case
(à coté de TeX)

Merci pour ta réponse rapide.
Alors en ce qui concerne vunofix il n'a rien trouvé. Voici les messages (en anglais) que j'ai eu :
done searching files.
done searching files were found.
no fils found vindofix v65.11 will now close

Par contre pour virtumondobegone et combolix voici les rapports.
rapport VBG

[11/05/2007, 16:09:45] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\JUSTINE\Bureau\VirtumundoBeGone.exe" )
[11/05/2007, 16:09:49] - Detected System Information:
[11/05/2007, 16:09:49] - Windows Version: 5.1.2600, Service Pack 2
[11/05/2007, 16:09:49] - Current Username: JUSTINE (Admin)
[11/05/2007, 16:09:49] - Windows is in NORMAL mode.
[11/05/2007, 16:09:49] - Searching for Browser Helper Objects:
[11/05/2007, 16:09:49] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[11/05/2007, 16:09:49] - BHO 2: {0EFD6E26-EE12-4FD9-9992-D12A86507EF5} ()
[11/05/2007, 16:09:50] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:50] - No filename found. Continuing.
[11/05/2007, 16:09:50] - BHO 3: {1C36D678-1F3D-4A2A-B5C9-63534F546E63} ()
[11/05/2007, 16:09:50] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:50] - No filename found. Continuing.
[11/05/2007, 16:09:50] - BHO 4: {3255F61B-9BAE-4B27-AE8F-1322159226EC} ()
[11/05/2007, 16:09:50] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:50] - No filename found. Continuing.
[11/05/2007, 16:09:50] - BHO 5: {3B1F13B8-D7D5-4601-960B-791280C7A532} ()
[11/05/2007, 16:09:50] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:50] - No filename found. Continuing.
[11/05/2007, 16:09:50] - BHO 6: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[11/05/2007, 16:09:50] - BHO 7: {58DFF639-58E9-4F6C-BE5A-EA01498FCE2A} ()
[11/05/2007, 16:09:50] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:51] - No filename found. Continuing.
[11/05/2007, 16:09:51] - BHO 8: {6A87B991-A31F-4130-AE72-6D0C294BF082} (DealioBHO Class)
[11/05/2007, 16:09:51] - BHO 9: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[11/05/2007, 16:09:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:51] - No filename found. Continuing.
[11/05/2007, 16:09:51] - BHO 10: {7ede5747-4636-4c94-a371-d3b44d84c85b} ()
[11/05/2007, 16:09:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:51] - Checking for HKLM\...\Winlogon\Notify\epwtwbvm
[11/05/2007, 16:09:51] - Key not found: HKLM\...\Winlogon\Notify\epwtwbvm, continuing.
[11/05/2007, 16:09:51] - BHO 11: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[11/05/2007, 16:09:51] - BHO 12: {B9E2CA01-B627-4B55-A8CA-09A7510E2044} ()
[11/05/2007, 16:09:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:52] - No filename found. Continuing.
[11/05/2007, 16:09:52] - BHO 13: {bbc84bd9-5d45-4fdf-bb14-06a280146639} ()
[11/05/2007, 16:09:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:52] - No filename found. Continuing.
[11/05/2007, 16:09:52] - BHO 14: {C5F8B83B-3EEB-420B-82FA-6A95E4019854} ()
[11/05/2007, 16:09:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:52] - Checking for HKLM\...\Winlogon\Notify\vtspq
[11/05/2007, 16:09:52] - Key not found: HKLM\...\Winlogon\Notify\vtspq, continuing.
[11/05/2007, 16:09:52] - BHO 15: {eb13a4a6-e229-4fe3-9a32-dd5149e523d5} ()
[11/05/2007, 16:09:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:52] - No filename found. Continuing.
[11/05/2007, 16:09:52] - BHO 16: {F45312A4-53F9-4DBF-BB9C-FE9411B41AE6} ()
[11/05/2007, 16:09:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:53] - No filename found. Continuing.
[11/05/2007, 16:09:53] - Finished Searching Browser Helper Objects
[11/05/2007, 16:09:53] - Finishing up...
[11/05/2007, 16:09:53] - Nothing found! Exiting...

Rapport combofix

il manque le rapport de Combofix

Merci pour ta réponse rapide.
Alors en ce qui concerne vunofix il n'a rien trouvé. Voici les messages (en anglais) que j'ai eu :
done searching files.
done searching files were found.
no fils found vindofix v65.11 will now close

Par contre pour virtumondobegone et combolix voici les rapports.
rapport VBG

[11/05/2007, 16:09:45] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\JUSTINE\Bureau\VirtumundoBeGone.exe" )
[11/05/2007, 16:09:49] - Detected System Information:
[11/05/2007, 16:09:49] - Windows Version: 5.1.2600, Service Pack 2
[11/05/2007, 16:09:49] - Current Username: JUSTINE (Admin)
[11/05/2007, 16:09:49] - Windows is in NORMAL mode.
[11/05/2007, 16:09:49] - Searching for Browser Helper Objects:
[11/05/2007, 16:09:49] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[11/05/2007, 16:09:49] - BHO 2: {0EFD6E26-EE12-4FD9-9992-D12A86507EF5} ()
[11/05/2007, 16:09:50] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:50] - No filename found. Continuing.
[11/05/2007, 16:09:50] - BHO 3: {1C36D678-1F3D-4A2A-B5C9-63534F546E63} ()
[11/05/2007, 16:09:50] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:50] - No filename found. Continuing.
[11/05/2007, 16:09:50] - BHO 4: {3255F61B-9BAE-4B27-AE8F-1322159226EC} ()
[11/05/2007, 16:09:50] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:50] - No filename found. Continuing.
[11/05/2007, 16:09:50] - BHO 5: {3B1F13B8-D7D5-4601-960B-791280C7A532} ()
[11/05/2007, 16:09:50] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:50] - No filename found. Continuing.
[11/05/2007, 16:09:50] - BHO 6: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[11/05/2007, 16:09:50] - BHO 7: {58DFF639-58E9-4F6C-BE5A-EA01498FCE2A} ()
[11/05/2007, 16:09:50] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:51] - No filename found. Continuing.
[11/05/2007, 16:09:51] - BHO 8: {6A87B991-A31F-4130-AE72-6D0C294BF082} (DealioBHO Class)
[11/05/2007, 16:09:51] - BHO 9: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[11/05/2007, 16:09:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:51] - No filename found. Continuing.
[11/05/2007, 16:09:51] - BHO 10: {7ede5747-4636-4c94-a371-d3b44d84c85b} ()
[11/05/2007, 16:09:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:51] - Checking for HKLM\...\Winlogon\Notify\epwtwbvm
[11/05/2007, 16:09:51] - Key not found: HKLM\...\Winlogon\Notify\epwtwbvm, continuing.
[11/05/2007, 16:09:51] - BHO 11: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[11/05/2007, 16:09:51] - BHO 12: {B9E2CA01-B627-4B55-A8CA-09A7510E2044} ()
[11/05/2007, 16:09:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:52] - No filename found. Continuing.
[11/05/2007, 16:09:52] - BHO 13: {bbc84bd9-5d45-4fdf-bb14-06a280146639} ()
[11/05/2007, 16:09:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:52] - No filename found. Continuing.
[11/05/2007, 16:09:52] - BHO 14: {C5F8B83B-3EEB-420B-82FA-6A95E4019854} ()
[11/05/2007, 16:09:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:52] - Checking for HKLM\...\Winlogon\Notify\vtspq
[11/05/2007, 16:09:52] - Key not found: HKLM\...\Winlogon\Notify\vtspq, continuing.
[11/05/2007, 16:09:52] - BHO 15: {eb13a4a6-e229-4fe3-9a32-dd5149e523d5} ()
[11/05/2007, 16:09:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:52] - No filename found. Continuing.
[11/05/2007, 16:09:52] - BHO 16: {F45312A4-53F9-4DBF-BB9C-FE9411B41AE6} ()
[11/05/2007, 16:09:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2007, 16:09:53] - No filename found. Continuing.
[11/05/2007, 16:09:53] - Finished Searching Browser Helper Objects
[11/05/2007, 16:09:53] - Finishing up...
[11/05/2007, 16:09:53] - Nothing found! Exiting...

Rapport combofix
ComboFix 07-11-05.2 - JUSTINE 2007-11-05 16:21:02.1 - NTFSx86
Running from: C:\Documents and Settings\JUSTINE\Bureau\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\HotbarSA
C:\Documents and Settings\All Users\Application Data\HotbarSA\HotbarSA.dat
C:\Documents and Settings\All Users\Application Data\HotbarSA\HotbarSA_kyf.dat
C:\Documents and Settings\All Users\Application Data\HotbarSA\HotbarSAAbout.mht
C:\Documents and Settings\All Users\Application Data\HotbarSA\HotbarSAau.dat
C:\Documents and Settings\All Users\Application Data\HotbarSA\HotbarSAEula.mht
C:\Documents and Settings\JUSTINE\Application Data\install_fr[1].exe
C:\Documents and Settings\JUSTINE\err.log
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\__c001444.dat
C:\WINDOWS\system32\__c00181F9.dat
C:\WINDOWS\system32\__c002A959.dat
C:\WINDOWS\system32\__c003860C.dat
C:\WINDOWS\system32\__c0051FF3.dat
C:\WINDOWS\system32\__c0055C49.dat
C:\WINDOWS\system32\__c0056A71.dat
C:\WINDOWS\system32\__c0062C3D.dat
C:\WINDOWS\system32\__c0063FC.dat
C:\WINDOWS\system32\__c0066BEE.dat
C:\WINDOWS\system32\__c006B19C.dat
C:\WINDOWS\system32\__c006DF72.dat
C:\WINDOWS\system32\__c0081204.dat
C:\WINDOWS\system32\__c008FD08.dat
C:\WINDOWS\system32\__c009AA3C.dat
C:\WINDOWS\system32\__c00AF004.dat
C:\WINDOWS\system32\__c00C2B6.dat
C:\WINDOWS\system32\__c00C45AC.dat
C:\WINDOWS\system32\__c00D3D16.dat
C:\WINDOWS\system32\__c00E087D.dat
C:\WINDOWS\system32\__c00EADCC.dat
C:\WINDOWS\system32\__c00EE9E1.dat
C:\WINDOWS\system32\__c00EEA4F.dat
C:\WINDOWS\system32\__c00F70F8.dat
C:\WINDOWS\system32\__c00FB990.dat
C:\WINDOWS\system32\__c00FF564.dat
C:\WINDOWS\system32\bawxccny.dll
C:\WINDOWS\system32\bemjvgkm.dll
C:\WINDOWS\system32\bkerwoqi.dll
C:\WINDOWS\system32\bxleaxph.dll
C:\WINDOWS\system32\cgsmbhex.dll
C:\WINDOWS\system32\crymqslq.dll
C:\WINDOWS\system32\dhwtuvpx.dll
C:\WINDOWS\system32\dldqrmso.dll
C:\WINDOWS\system32\ejolkhxf.dll
C:\WINDOWS\system32\elpptbja.dll
C:\WINDOWS\system32\enalfmyb.dll
C:\WINDOWS\system32\eusmckjk.dll
C:\WINDOWS\system32\eutjxrlf.dll
C:\WINDOWS\system32\evpmuyww.dll
C:\WINDOWS\system32\fvvpxrro.dll
C:\WINDOWS\system32\gcquygru.dll
C:\WINDOWS\system32\gdjdsifc.dll
C:\WINDOWS\system32\ggqkmaww.dll
C:\WINDOWS\system32\gksugsgg.dll
C:\WINDOWS\system32\gtmrapkf.dll
C:\WINDOWS\system32\haujsivg.dll
C:\WINDOWS\system32\hflphbyn.dll
C:\WINDOWS\system32\hxgbnele.dll
C:\WINDOWS\system32\ianccwxv.dll
C:\WINDOWS\system32\ibaxcgwx.dll
C:\WINDOWS\system32\ieqdosyu.dll
C:\WINDOWS\system32\ilodbleg.dll
C:\WINDOWS\system32\ilucvprg.dll
C:\WINDOWS\system32\ixwoerhu.dll
C:\WINDOWS\system32\jbnllmhd.dll
C:\WINDOWS\system32\jcmcwncx.dll
C:\WINDOWS\system32\jgrkmppf.dll
C:\WINDOWS\system32\jwcfgscc.dll
C:\WINDOWS\system32\jwtkcwqw.dll
C:\WINDOWS\system32\kbammaow.dll
C:\WINDOWS\system32\lgvmrmtp.dll
C:\WINDOWS\system32\lxemgfat.dll
C:\WINDOWS\system32\mjfifycs.dll
C:\WINDOWS\system32\mpgcetgu.dll
C:\WINDOWS\system32\mttusapy.dll
C:\WINDOWS\system32\mxkfqkfi.dll
C:\WINDOWS\system32\nhjyuasd.dll
C:\WINDOWS\system32\nygcvino.dll
C:\WINDOWS\system32\nyldcaad.dll
C:\WINDOWS\system32\oiynsmgt.dll
C:\WINDOWS\system32\oysyqdjr.dll
C:\WINDOWS\system32\pajtatvl.dll
C:\WINDOWS\system32\prsxyabe.dll
C:\WINDOWS\system32\pvlrynlk.dll
C:\WINDOWS\system32\qdjrvdcx.dll
C:\WINDOWS\system32\qepishqj.dll
C:\WINDOWS\system32\qgykubdd.dll
C:\WINDOWS\system32\qpstv.bak1
C:\WINDOWS\system32\qpstv.bak2
C:\WINDOWS\system32\qpstv.ini
C:\WINDOWS\system32\qpstv.ini2
C:\WINDOWS\system32\qpstv.tmp
C:\WINDOWS\system32\rkpriamw.dll
C:\WINDOWS\system32\smoppyvl.dll
C:\WINDOWS\system32\srrlmhwc.dll
C:\WINDOWS\system32\ssnulqtw.dll
C:\WINDOWS\system32\stcqnfix.dll
C:\WINDOWS\system32\sxltttuk.dll
C:\WINDOWS\system32\tllbamyd.dll
C:\WINDOWS\system32\tojnjpfa.dll
C:\WINDOWS\system32\unwteyqe.dll
C:\WINDOWS\system32\upiqxapp.dll
C:\WINDOWS\system32\uwerwfat.dll
C:\WINDOWS\system32\vflkgixw.dll
C:\WINDOWS\system32\vgolpbrw.dll
C:\WINDOWS\system32\vtspq.dll
C:\WINDOWS\system32\webpxnvc.dll
C:\WINDOWS\system32\wegvukdo.dll
C:\WINDOWS\system32\wgarhnmk.dll
C:\WINDOWS\system32\xawsngct.dll
C:\WINDOWS\system32\xqttfvfg.dll
C:\WINDOWS\system32\xvoiyswj.dll
C:\WINDOWS\system32\xwmsjfmn.dll
C:\WINDOWS\system32\yoyulkis.dll

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-05 to 2007-11-05 ))))))))))))))))))))))))))))))))))))
.

2007-11-05 16:14 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-05 15:47 <REP> d-------- C:\VundoFix Backups
2007-11-05 14:52 <REP> d-------- C:\Program Files\Navilog1
2007-11-05 14:26 83,008 --a------ C:\WINDOWS\system32\epwtwbvm.dll
2007-11-05 14:23 67,648 --a------ C:\WINDOWS\system32\geimvhmm.dll
2007-11-05 14:08 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-11-05 14:08 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-11-05 14:08 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-05 14:08 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-11-05 14:07 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-11-05 14:07 92,848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-11-05 14:07 83,008 --a------ C:\WINDOWS\system32\dpjnrbys.dll
2007-11-05 14:07 67,648 --a------ C:\WINDOWS\system32\pcmteyup.dll
2007-11-05 14:06 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-11-05 13:52 83,008 --a------ C:\WINDOWS\system32\vccwpujc.dll
2007-11-05 12:13 83,008 --a------ C:\WINDOWS\system32\uueewchg.dll
2007-11-05 10:46 <REP> d-------- C:\Program Files\Spyware Doctor
2007-11-05 10:46 <REP> d-------- C:\Documents and Settings\JUSTINE\Application Data\PC Tools
2007-11-05 10:46 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-11-05 10:46 83,536 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2007-11-05 10:46 59,984 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2007-11-05 10:46 52,304 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-11-05 10:46 39,248 --a------ C:\WINDOWS\system32\drivers\ikfileflt.sys
2007-11-05 10:46 26,064 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2007-11-05 10:28 83,008 --a------ C:\WINDOWS\system32\vripeiwj.dll
2007-11-04 23:08 78,912 --a------ C:\WINDOWS\system32\saubyprg.dll
2007-11-04 22:44 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2007-11-04 22:19 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2007-11-04 22:19 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2007-11-04 22:19 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2007-11-04 22:19 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2007-11-04 22:19 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2007-11-04 22:19 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2007-11-04 22:19 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2007-11-04 21:47 78,912 --a------ C:\WINDOWS\system32\iepuaeld.dll
2007-11-04 20:37 <REP> d-------- C:\Program Files\Alwil Software
2007-11-04 20:23 78,912 --a------ C:\WINDOWS\system32\vkqdmvas.dll
2007-11-04 19:51 <REP> d-------- C:\Program Files\TuneUp Utilities 2006
2007-11-04 19:51 <REP> d-------- C:\Documents and Settings\JUSTINE\Application Data\TuneUp Software
2007-11-04 19:51 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2007-11-04 19:47 78,912 --a------ C:\WINDOWS\system32\jebydgvs.dll
2007-11-04 16:26 78,912 --a------ C:\WINDOWS\system32\fvxhihpe.dll
2007-11-04 16:10 <REP> d-------- C:\Program Files\Lavasoft
2007-11-04 16:10 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-04 16:07 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-04 16:05 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-11-04 15:58 78,912 --a------ C:\WINDOWS\system32\fxsnstgo.dll
2007-11-04 12:12 78,912 --a------ C:\WINDOWS\system32\iomkikfq.dll
2007-11-03 10:50 81,472 --a------ C:\WINDOWS\system32\vfterfic.dll
2007-10-31 20:57 <REP> d-------- C:\Program Files\Messenger Plus! Live
2007-10-10 15:56 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-04 20:10 --------- d-----w C:\Program Files\MP3 Player Utilities 3.5.02
2007-11-04 19:38 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2007-11-04 19:30 --------- d-----w C:\Program Files\Norton AntiVirus
2007-11-04 19:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-04 16:52 --------- d-----w C:\Documents and Settings\JUSTINE\Application Data\WeatherDPA
2007-11-04 16:47 --------- d-----w C:\Program Files\Fichiers communs\DriveCleaner 2006 Free
2007-11-04 15:10 --------- d-----w C:\Documents and Settings\JUSTINE\Application Data\Lavasoft
2007-11-04 11:08 --------- d-----w C:\Program Files\Lx_cats
2007-10-04 18:11 79,936 ----a-w C:\WINDOWS\system32\wihscnwd.dll
2007-10-03 18:09 79,936 ----a-w C:\WINDOWS\system32\swvaqhqd.dll
2007-10-02 18:10 79,936 ----a-w C:\WINDOWS\system32\qybhjnom.dll
2007-10-01 18:07 79,936 ----a-w C:\WINDOWS\system32\ystjixft.dll
2007-09-30 12:05 79,936 ----a-w C:\WINDOWS\system32\aedfmcuk.dll
2007-09-29 12:07 79,936 ----a-w C:\WINDOWS\system32\jdpfoksk.dll
2007-09-27 07:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-09-16 09:17 --------- d-----w C:\Program Files\Disc2Phone
2007-09-15 21:12 --------- d-----w C:\Documents and Settings\JUSTINE\Application Data\Teleca
2007-09-15 21:05 --------- d-----w C:\Documents and Settings\JUSTINE\Application Data\Sony Ericsson
2007-09-15 20:59 --------- d-----w C:\Program Files\Fichiers communs\Teleca Shared
2007-09-15 20:59 --------- d-----w C:\Program Files\Fichiers communs\Sony Ericsson Shared
2007-09-15 20:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Teleca
2007-09-15 20:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sony Ericsson
2007-09-15 20:58 --------- d-----w C:\Program Files\Sony Ericsson
2007-08-21 06:17 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-16 14:17 51,568 ----a-w C:\WINDOWS\system32\sirenacm.dll
2006-11-22 19:56 17,832 ----a-w C:\Documents and Settings\JUSTINE\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0EFD6E26-EE12-4FD9-9992-D12A86507EF5}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1C36D678-1F3D-4A2A-B5C9-63534F546E63}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3255F61B-9BAE-4B27-AE8F-1322159226EC}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3B1F13B8-D7D5-4601-960B-791280C7A532}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{58DFF639-58E9-4F6C-BE5A-EA01498FCE2A}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7ede5747-4636-4c94-a371-d3b44d84c85b}]
2007-11-05 14:26 83008 --a------ C:\WINDOWS\system32\epwtwbvm.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B9E2CA01-B627-4B55-A8CA-09A7510E2044}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bbc84bd9-5d45-4fdf-bb14-06a280146639}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C5F8B83B-3EEB-420B-82FA-6A95E4019854}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{eb13a4a6-e229-4fe3-9a32-dd5149e523d5}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F45312A4-53F9-4DBF-BB9C-FE9411B41AE6}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C-Media Mixer"="Mixer.exe" [2004-02-25 20:52 C:\WINDOWS\mixer.exe]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-02-23 14:45]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-04-18 17:26]
"au"="C:\Program Files\Dealio\DealioAU.exe" [2007-06-27 11:46]
"BigDogPath"="C:\WINDOWS\VM_STI.exe" [2005-10-28 14:48]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" []
"LXCDCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCDtime.dll" [2005-07-11 17:35]
"lxcdmon.exe"="C:\Program Files\Lexmark 6300 Series\lxcdmon.exe" [2005-06-24 18:17]
"EzPrint"="C:\Program Files\Lexmark 6300 Series\ezprint.exe" [2005-07-05 12:51]
"FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2005-07-12 10:36]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2006-11-24 00:06]
"f8d5f266"="C:\WINDOWS\system32\pcmteyup.dll" [2007-11-05 14:07]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-11-05 10:52]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-03-13 17:55]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opppo]
C:\WINDOWS\system32\opppo.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\vtspq.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

R2 UMAXPCLS;Pilote de scanneur pour port imprimante;C:\WINDOWS\system32\DRIVERS\umaxpcls.sys
S0 dmx3191;dmx3191;C:\WINDOWS\system32\DRIVERS\dmx3191.sys
S3 se57bus;Sony Ericsson Device 087 driver (WDM);C:\WINDOWS\system32\DRIVERS\se57bus.sys
S3 se57mdfl;Sony Ericsson Device 087 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\se57mdfl.sys
S3 se57mdm;Sony Ericsson Device 087 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\se57mdm.sys
S3 se57mgmt;Sony Ericsson Device 087 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\se57mgmt.sys
S3 se57obex;Sony Ericsson Device 087 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\se57obex.sys
S3 se57unic;Sony Ericsson Device 087 USB Ethernet Emulation SEMC57 (WDM);C:\WINDOWS\system32\DRIVERS\se57unic.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4f20cb37-0d11-11dc-9fb0-000d88277bb0}]
\Shell\AutoRun\command - H:\start.exe
\Shell\FramaKey\command - H:\start.exe

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-11-04 18:52:35 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-05 16:50:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-05 16:57:03 - machine was rebooted
.
--- E O F ---

il y a eu du ménage mais il en reste on va voir si FixVundo en trouvent d'autre

Télécharger et enregistrer sur le bureau
FixVundo.exe
=Fermer les programmes
= Déconnecter internet
= Double-clic FixVundo.exe
= Clic Start
si message d’erreurs ==> clic OK
=copier le rapport
------
si rien ( = Vundo not found ) inutile de poster le rapport

fixvundo n'a rien trouvé. Sinon voici le rapport

Symantec Trojan.Vundo Removal Tool 1.5.0

C:\Documents and Settings\JUSTINE\Local Settings\Application Data\Microsoft\Messenger\justinepennec@hotmail.fr\SharingMetadata\fredd29200@hotmail.fr\DFSR\Staging\CS{3B75EFB4-57C4-EBE6-63E5-A1F36E6C0725}\01\11-{3B75EFB4-57C4-EBE6-63E5-A1F36E6C0725}-v1-{11A9D981-19AC-4A19-BEBB-5D900D069E87}-v11-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\JUSTINE\Local Settings\Application Data\Microsoft\Messenger\justinepennec@hotmail.fr\SharingMetadata\le-ouffdu29@hotmail.fr\DFSR\Staging\CS{C14270B0-6FD0-FC86-1D65-A3DFDA2AA1DA}\01\10-{C14270B0-6FD0-FC86-1D65-A3DFDA2AA1DA}-v1-{11A9D981-19AC-4A19-BEBB-5D900D069E87}-v10-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\JUSTINE\Local Settings\Application Data\Microsoft\Messenger\moalamissdu29@hotmail.fr\SharingMetadata\yuyu-gonz@hotmail.fr\DFSR\Staging\CS{9A11EB51-5229-3037-C4DA-2469A3D2CF77}\01\10-{9A11EB51-5229-3037-C4DA-2469A3D2CF77}-v1-{DF8270CA-DD32-4347-82A1-FB23FB6ADD7E}-v10-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\JUSTINE\Local Settings\Application Data\Microsoft\Messenger\moalamissdu29@hotmail.fr\SharingMetadata\yuyu-gonz@hotmail.fr\DFSR\Staging\CS{9A11EB51-5229-3037-C4DA-2469A3D2CF77}\32\430-{4FA20E76-A4A3-4E79-901E-32DEE47A02C3}-v132-{4FA20E76-A4A3-4E79-901E-32DEE47A02C3}-v430-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\JUSTINE\Local Settings\Application Data\Microsoft\Messenger\moalamissdu29@hotmail.fr\SharingMetadata\yuyu-gonz@hotmail.fr\DFSR\Staging\CS{9A11EB51-5229-3037-C4DA-2469A3D2CF77}\33\431-{4FA20E76-A4A3-4E79-901E-32DEE47A02C3}-v133-{4FA20E76-A4A3-4E79-901E-32DEE47A02C3}-v431-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\JUSTINE\Local Settings\Application Data\Microsoft\Messenger\moalamissdu29@hotmail.fr\SharingMetadata\yuyu-gonz@hotmail.fr\DFSR\Staging\CS{9A11EB51-5229-3037-C4DA-2469A3D2CF77}\34\432-{4FA20E76-A4A3-4E79-901E-32DEE47A02C3}-v134-{4FA20E76-A4A3-4E79-901E-32DEE47A02C3}-v432-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\JUSTINE\Local Settings\Application Data\Microsoft\Messenger\moalamissdu29@hotmail.fr\SharingMetadata\yuyu-gonz@hotmail.fr\DFSR\Staging\CS{9A11EB51-5229-3037-C4DA-2469A3D2CF77}\43\433-{4FA20E76-A4A3-4E79-901E-32DEE47A02C3}-v143-{4FA20E76-A4A3-4E79-901E-32DEE47A02C3}-v433-Downloading.frx (WARNING: not scanned, path to long)
C:\System Volume Information: (not scanned)
D:\System Volume Information: (not scanned)
Trojan.Vundo has not been found on your computer.

Télécharger sur le bureau

Otmoveit.exe

= Copier ce texte en gras


C:\WINDOWS\system32\epwtwbvm.dll
C:\WINDOWS\system32\geimvhmm.dll
C:\WINDOWS\system32\dpjnrbys.dll
C:\WINDOWS\system32\pcmteyup.dll
C:\WINDOWS\system32\vccwpujc.dll
C:\WINDOWS\system32\uueewchg.dll
C:\WINDOWS\system32\vripeiwj.dll
C:\WINDOWS\system32\saubyprg.dll
C:\WINDOWS\system32\vkqdmvas.dll
C:\WINDOWS\system32\jebydgvs.dll
C:\WINDOWS\system32\fvxhihpe.dll
C:\WINDOWS\system32\fxsnstgo.dll
C:\WINDOWS\system32\iomkikfq.dll
C:\WINDOWS\system32\vfterfic.dll


= Double-clic sur OTMoveIt.exe
= Dans le cadre de Gauche ==> clic-droit ==> coller
= Clic MoveIt!
= si redémarrage demandé==> Clic : YES
= Un rapport dans ==> C:\_OTMoveIt\MovedFiles\date du jour à copier/coller dans la réponse
-------

redémarrer le PC et dire si encore des problèmes

voila le rapport mais à priori c'est bon. Si tu vois un truc de spécial

DllUnregisterServer procedure not found in C:\WINDOWS\system32\epwtwbvm.dll
C:\WINDOWS\system32\epwtwbvm.dll NOT unregistered.
C:\WINDOWS\system32\epwtwbvm.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\geimvhmm.dll
C:\WINDOWS\system32\geimvhmm.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\geimvhmm.dll scheduled to be moved on reboot.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\dpjnrbys.dll
C:\WINDOWS\system32\dpjnrbys.dll NOT unregistered.
C:\WINDOWS\system32\dpjnrbys.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\pcmteyup.dll
C:\WINDOWS\system32\pcmteyup.dll NOT unregistered.
C:\WINDOWS\system32\pcmteyup.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\vccwpujc.dll
C:\WINDOWS\system32\vccwpujc.dll NOT unregistered.
C:\WINDOWS\system32\vccwpujc.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\uueewchg.dll
C:\WINDOWS\system32\uueewchg.dll NOT unregistered.
C:\WINDOWS\system32\uueewchg.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\vripeiwj.dll
C:\WINDOWS\system32\vripeiwj.dll NOT unregistered.
C:\WINDOWS\system32\vripeiwj.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\saubyprg.dll
C:\WINDOWS\system32\saubyprg.dll NOT unregistered.
C:\WINDOWS\system32\saubyprg.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\vkqdmvas.dll
C:\WINDOWS\system32\vkqdmvas.dll NOT unregistered.
C:\WINDOWS\system32\vkqdmvas.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\jebydgvs.dll
C:\WINDOWS\system32\jebydgvs.dll NOT unregistered.
C:\WINDOWS\system32\jebydgvs.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\fvxhihpe.dll
C:\WINDOWS\system32\fvxhihpe.dll NOT unregistered.
C:\WINDOWS\system32\fvxhihpe.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\fxsnstgo.dll
C:\WINDOWS\system32\fxsnstgo.dll NOT unregistered.
C:\WINDOWS\system32\fxsnstgo.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\iomkikfq.dll
C:\WINDOWS\system32\iomkikfq.dll NOT unregistered.
C:\WINDOWS\system32\iomkikfq.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\vfterfic.dll
C:\WINDOWS\system32\vfterfic.dll NOT unregistered.
C:\WINDOWS\system32\vfterfic.dll moved successfully.

Created on 11/05/2007 19:24:05

as tu encore des problemes ?